JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 172.170.254.20

172.170.254.20 was found in our database!

This IP was reported 326 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Des Moines, Iowa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 172.170.254.20

Whois 172.170.254.20

IP Abuse Reports for 172.170.254.20:

This IP address has been reported a total of 326 times from 270 distinct sources. 172.170.254.20 was first reported on July 17th 2026, and the most recent report was 5 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 JCB	2026-07-18 08:03:00 (5 hours ago)	172.170.254.20 - - [18/Jul/2026:02:44:11 +0300] "GET /a.php HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Wind ... show more 172.170.254.20 - - [18/Jul/2026:02:44:11 +0300] "GET /a.php HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.170.254.20 - - [18/Jul/2026:02:44:11 +0300] "GET /a1.php HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Web App Attack
Anonymous	2026-07-18 06:35:57 (7 hours ago)	"GET /admin.php HTTP/1.1"	Hacking Web App Attack
🇮🇳 evicky2002	2026-07-18 06:00:00 (8 hours ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇭🇺 DumaNet	2026-07-18 05:17:00 (8 hours ago)	Web app attack attempts, scanning for vulnerability. Date: 2026 Jul 18. 01:56:41 Source IP: 172.17 ... show more Web app attack attempts, scanning for vulnerability. Date: 2026 Jul 18. 01:56:41 Source IP: 172.170.254.20 Portion of the log(s): 172.170.254.20 - [18/Jul/2026:01:56:41 +0200] "GET /jquery.php HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.170.254.20 - [18/Jul/2026:01:56:41 +0200] "GET /jga.php HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.170.254.20 - [18/Jul/2026:01:56:41 +0200] "GET /item.php HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.170.254.20 - [18/Jul/2026:01:56:41 +0200] "GET /iqps3ldefault.php HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.170.254.20 - [18/Jul/2026:01:56:41 +0200] "GET /ioxi-o.php HTTP/1.1" 404 show less	Web App Attack
🇬🇧 openstrike.co.uk	2026-07-18 05:14:44 (8 hours ago)	4992 attacks on PHP URLs: GET /rh.php HTTP/1.1	Web App Attack
🇭🇺 DumaNet	2026-07-18 04:53:00 (9 hours ago)	Web app attack attempts, scanning for vulnerability. Date: 2026 Jul 18. 00:20:32 Source IP: 172.17 ... show more Web app attack attempts, scanning for vulnerability. Date: 2026 Jul 18. 00:20:32 Source IP: 172.170.254.20 Portion of the log(s): 172.170.254.20 - [18/Jul/2026:00:20:32 +0200] "GET /jga.php HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.170.254.20 - [18/Jul/2026:00:20:32 +0200] "GET /item.php HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.170.254.20 - [18/Jul/2026:00:20:32 +0200] "GET /iqps3ldefault.php HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.170.254.20 - [18/Jul/2026:00:20:32 +0200] "GET /ioxi-o.php HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.170.254.20 - [18/Jul/2026:00:20:32 +0200] "GET /install.php HTTP/1.1" 404 show less	Web App Attack
🇲🇽 octageeks.com	2026-07-18 04:19:46 (9 hours ago)	Wordpress malicious attack:[octablocked]	Web App Attack
🇬🇧 thetomtaylor.co.uk	2026-07-18 02:07:02 (11 hours ago)	Fail2Ban - [WEB]Custom exploit pattern detected on customexploits ... [wa01,wa02]	Hacking Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-18 01:51:21 (12 hours ago)	Automated report (2026-07-18T09:51:21+08:00). Caught probing for CVE-2011-5148 vulnerability.	Hacking Web App Attack Open Proxy
🇩🇪 mondor.ro	2026-07-18 01:50:15 (12 hours ago)	Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, TEMPDENY 172.170.254.20, Re ... show more Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, TEMPDENY 172.170.254.20, Reason:[172.170.254.20 (US/United States/-), more than 60 Apache 404 hits in the last 3600 secs]; Ports: 80,443; Direction: in; Trigger: LF_CLUSTER; Logs: show less	Port Scan
🇮🇹 Inartis	2026-07-18 01:45:59 (12 hours ago)	[Sat Jul 18 03:45:57.432361 2026] [proxy_fcgi:error] [pid 1709350:tid 1709350] [client 172.170.254.2 ... show more [Sat Jul 18 03:45:57.432361 2026] [proxy_fcgi:error] [pid 1709350:tid 1709350] [client 172.170.254.20:23779] AH01071: Got error 'Primary script unknown' [Sat Jul 18 03:45:57.549530 2026] [proxy_fcgi:error] [pid 1709350:tid 1709350] [client 172.170.254.20:23779] AH01071: Got error 'Primary script unknown' [Sat Jul 18 03:45:59.033866 2026] [proxy_fcgi:error] [pid 1708435:tid 1708435] [client 172.170.254.20:24350] AH01071: Got error 'Primary script unknown' ... show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Skyrider	2026-07-18 01:44:55 (12 hours ago)	crowdsecurity/http-probing	Web App Attack
🇹🇷 ycoskun41	2026-07-18 01:43:01 (12 hours ago)	fail2ban: plesk-modsecurity jail on genckocaeli.com	Web App Attack
🇩🇪 lightaffaire	2026-07-18 01:42:51 (12 hours ago)	Jul 18 03:42:51 www.content-honcho.com 172.170.254.20 - - [18/Jul/2026:03:42:51 +0200] "GET /wp-cont ... show more Jul 18 03:42:51 www.content-honcho.com 172.170.254.20 - - [18/Jul/2026:03:42:51 +0200] "GET /wp-content/plugins/twenty/login.php HTTP/1.1" 403 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
Anonymous	2026-07-18 01:41:57 (12 hours ago)	172.170.254.20 - - [18/Jul/2026:03:41:34 +0200] "GET /img/class-wp-http-client.php HTTP/1.1" 404 341 ... show more 172.170.254.20 - - [18/Jul/2026:03:41:34 +0200] "GET /img/class-wp-http-client.php HTTP/1.1" 404 34163 172.170.254.20 - - [18/Jul/2026:03:41:36 +0200] "GET /in.php HTTP/1.1" 404 29058 172.170.254.20 - - [18/Jul/2026:03:41:38 +0200] "GET /inc.php HTTP/1.1" 404 29058 172.170.254.20 - - [18/Jul/2026:03:41:41 +0200] "GET /index/function.php HTTP/1.1" 404 29059 172.170.254.20 - - [18/Jul/2026:03:41:43 +0200] "GET /index4.php HTTP/1.1" 404 29059 172.170.254.20 - - [18/Jul/2026:03:41:45 +0200] "GET /info.php HTTP/1.1" 404 29058 172.170.254.20 - - [18/Jul/2026:03:41:46 +0200] "GET /init.php HTTP/1.1" 404 29059 172.170.254.20 - - [18/Jul/2026:03:41:48 +0200] "GET /inputs.php HTTP/1.1" 404 29058 172.170.254.20 - - [18/Jul/2026:03:41:50 +0200] "GET /install.php HTTP/1.1" 404 29058 172.170.254.20 - - [18/Jul/2026:03:41:52 +0200] "GET /ioxi-o.php HTTP/1.1" 404 29059 ... show less	Web Spam Web App Attack

Showing 1 to 15 of 326 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇷 85.185.201.10

🇫🇷 51.75.120.177

🇰🇷 203.236.109.13

🇨🇳 182.124.11.228

🇩🇪 164.92.161.148

🇺🇸 157.230.59.143

🇮🇳 157.119.43.187

🇯🇵 124.18.182.99

🇺🇸 108.181.56.189

🇮🇳 103.157.149.14

🇧🇷 45.205.1.240

🇳🇱 45.142.193.197

🇪🇬 41.32.147.75

🇩🇪 31.70.78.222

🇨🇳 182.138.158.42

🇵🇱 176.53.159.198

🇺🇸 161.35.8.9

🇩🇪 130.12.182.98

🇨🇿 109.172.8.83

🇫🇷 91.196.152.238